We find SSTP to be the most vulnerable protocol with more than 90% of detected servers being vulnerable to TLS downgrade attacks. We find 9.8M VPN servers distributed around the world using OpenVPN, SSTP, PPTP, and IPsec, and analyze their vulnerability. To this end, we perform Internet-wide active measurements to find VPN servers in the wild, and characterize them based on their vulnerabilities, certificates, locations, and fingerprinting. In this paper, we aim at detecting and characterizing VPN servers in the wild, which facilitates detecting the VPN traffic.

VPN users are also concerned about the vulnerabilities of their VPN connections due to privacy issues. It is, however, challenging to detect and characterize VPN traffic since some VPN protocols use the same port number as web traffic and port-based traffic classification will not help.

Therefore, measuring the traffic and security aspects of the VPN ecosystem is more important now than ever. With the shift to working remotely after the COVID-19 pandemic, the use of Virtual Private Networks (VPNs) around the world has nearly doubled.

Networkminer